At TINA, protecting the privacy of patient health data is a core priority. TINA’s End-to-End Encryption (E2EE) feature is designed so that sensitive information is encrypted in the user’s browser before it is sent to the server. Encrypted data remains protected while it is transmitted and stored. Authorized users unlock access with the organization’s E2EE PIN.
What Is End-to-End Encryption?
End-to-End Encryption is a security model in which data is encrypted before it leaves the user’s device and decrypted only on an authorized device.
In TINA:
- Sensitive fields are encrypted locally in the browser.
- The encrypted values are sent to the TINA API.
- The server stores and returns the encrypted values.
- An authorized user enters the organization’s E2EE PIN.
- The browser uses that PIN to decrypt the data.
This means the PIN is not transmitted to the server, and the server does not need the unencrypted data key to store or transport protected patient information.
Why Use E2EE for Patient Data?
Patient records often contain highly sensitive information, including clinical notes, contact details, treatment information, and other health-related data. Encrypting these fields before transmission provides an additional layer of protection.
Protection Against Unauthorized Access
If encrypted application data is accessed without the corresponding encryption key, the protected fields cannot be read directly.
Privacy During Transmission and Storage
Sensitive fields remain encrypted in API payloads and in the application data handled by the server. HTTPS/TLS continues to protect the network connection, while E2EE provides an additional client-side encryption layer.
Controlled Access
Only a user who has access to the organization and knows the organization’s E2EE PIN can unlock the shared encryption key in the browser.
Support for Secure Multi-Device Access
The PIN is associated with the organization rather than only one computer. This allows authorized users to unlock the same organization data from another browser or device using the correct E2EE PIN.
Setting Up E2EE in TINA
Step 1: Sign In as an Authorized Organization User
An authorized organization user signs in to TINA and opens the encryption settings.
Depending on the organization’s current setup, TINA may offer the option to:
- Set up a new E2EE PIN
- Import existing legacy encryption key material
- Unlock an existing E2EE configuration
Step 2: Set an E2EE PIN
The user creates and confirms a six-digit numeric E2EE PIN.
Step 3: Unlock E2EE on Each Device
When the user signs in from another computer or browser the user enters the same E2EE PIN. The browser then makes the session ready to decrypt protected information.
Using E2EE on a New Computer
E2EE is designed to support access from multiple devices. When opening TINA on a new computer:
- The user signs in normally.
- TINA displays the E2EE unlock prompt.
- The user enters the organization’s six-digit E2EE PIN.
- The browser decrypts the data key in memory.
- Protected information becomes available to the unlocked session.
Legacy Encryption Key Support
TINA also supports legacy encryption key material during the migration process.
Legacy key material can be imported when required and is held in the browser’s session storage for backward compatibility. Users with legacy encryption configured are encouraged to enroll a v2 E2EE PIN. The v2 PIN-based process is the preferred approach for new setups.
What Happens When the Session Is Locked?
When E2EE is locked:
- Protected values may remain encrypted in the interface.
- TINA can still perform operations that do not require decryption.
- Sensitive write operations must wait until the user unlocks E2EE.
- The in-memory encryption context is unavailable.
After the correct PIN is entered, the browser restores the encryption context and protected read and write operations can continue.
Important PIN and Key Management Guidance
The current E2EE PIN is a six-digit numeric PIN. This makes it easy to use, but it also means that PIN security depends on keeping the PIN protected. For better security:
- Do not share the PIN through insecure channels.
- Do not reuse the E2EE PIN as an account password.
- Do not store the PIN in a browser, password field, document, or unencrypted note.
- Use a PIN that is difficult for other organization members to guess.
- Limit access to organization accounts and administrator settings.
- Notify TINA support if the PIN may have been exposed.
- Keep account passwords and E2EE PINs separate.
Troubleshooting E2EE
The Unlock Prompt Appears on a New Device
This is expected. The new browser does not have an active in-memory encryption context yet. Enter the organization’s E2EE PIN to unlock it.
The PIN Is Rejected
Confirm that:
- The PIN contains exactly six digits.
- You are using the organization’s current E2EE PIN.
- The account belongs to the correct organization.
- The organization’s E2EE configuration has not recently been changed.
Legacy Key Material Is Required
If the organization has not migrated from the legacy setup, an administrator may need to import the existing legacy key material before enrolling the v2 PIN. If you did not and it shows up please contact our support team.
The PIN Has Been Lost
The PIN is not sent to TINA and cannot be recovered from the server. Contact TINA support before changing or resetting the organization’s encryption configuration. Do not create a new encryption key until the existing data-recovery options have been reviewed, because a new key may not decrypt data protected with the previous key.
Conclusion
TINA’s E2EE feature adds client-side protection for sensitive patient information. Sensitive fields are encrypted in the browser, and the raw PIN is never stored or transmitted.
Authorized users can access protected data from multiple devices by entering the organization’s E2EE PIN, while the usable encryption key remains available only in the browser’s active unlocked session.
For setup assistance or questions about migrating legacy encryption keys, contact TINA support.